Splunk rules: 1d

id: '5986.6347'
title: Access Common Package Config file
description: 'Adversaries may establish persistence and/or elevate privileges using
  system mechanisms that trigger execution based on specific events. An Adversary
  with access could identify or modify configuration of packages in order to execute
  code and evade defenses. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(vi) OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit)
  OR (TERM(copy) TERM(con)) OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content)
  OR ">>" OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec"
  OR "gemrc") | regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
  | table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution
- privilege-escalation:event triggered execution
technique_id: 
- T1546
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

name: Azure AD Service Principal Enumeration
id: 3f0647ce-add5-4436-8039-cbd1abe74563
version: 10
creation_date: '2025-01-05'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: >-
    This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals.
    This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools.
data_source:
    - Azure Active Directory MicrosoftGraphActivityLogs
search: |-
    `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals)
      | fillnull
      | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P<servicePrincipalb>.*?)\/"
      | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/v1.0\/servicePrincipals\/(?P<servicePrincipalv1>.*?)\/"
      | eval spn=coalesce(servicePrincipalb,servicePrincipalv1)
      | fillnull
      | stats count min(_time) as _time dc(spn) as spn_count values(user_id) as user_id
        BY dest user src
           vendor_account vendor_product signature
      | where spn_count>9
      | `azure_ad_service_principal_enumeration_filter`
how_to_implement: >-
    Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements.
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/SpecterOps/AzureHound
    - https://github.com/dirkjanm/ROADtools
    - https://splunkbase.splunk.com/app/3110
    - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Install/
finding:
    title: $spn_count$ Service Principals have been enumerated by $user_id$ from IP $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Compromised User Account
asset_type: Azure Tenant
mitre_attack_id:
    - T1087.004
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure Automation Account Created
id: 860902fd-2e76-46b3-b050-ba548dab576c
version: 14
creation_date: '2022-08-22'
modification_date: '2026-05-13'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Azure Automation account within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when an account is created or updated. This activity is significant because Azure Automation accounts can be used to automate tasks and orchestrate actions across Azure and on-premise environments. If an attacker creates an Automation account with elevated privileges, they could maintain persistence, execute malicious runbooks, and potentially escalate privileges or execute code on virtual machines, posing a significant security risk.
data_source:
    - Azure Audit Create or Update an Azure Automation account
search: |-
    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/write" status.value=Succeeded
      | dedup object
      | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as signature
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product object
           object_path signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_automation_account_created_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/automation/overview
    - https://docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account?tabs=azureportal
    - https://docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker
    - https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
    - https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
    - https://attack.mitre.org/techniques/T1136/003/
finding:
    title: A new Azure Automation account $object$ was created by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Azure Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Cisco IOS XE Reconnaissance Command Activity
id: 71ac5328-2364-40cf-8381-92b8dc531399
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft.
    Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths.
    This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("AAA", "HA_EM")
    mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
    message_text IN (
        "*show running-config*",
        "*show tacacs*",
        "*show cdp neighbors*",
        "*show file systems*",
        "*dir bootflash:*",
        "*show clock*",
        "*show platform software status control-processor brief*",
        "*terminal length 0*",
        "*terminal width 0*"
    )

    | rex field=message_text "^\w+:(?<aaa_src>[^:@]+)(?:@[^:]*)?:(?<aaa_user>[^:]*):(?<aaa_command>.*?)(?:\s+\((?<aaa_result>SUCCESS|FAILURE)\))?$"
    | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
    | eval command=lower(trim(coalesce(aaa_command, eem_command, "")))

    | eval command_type=case(
        like(command, "show running-config%"), "show_conf",
        like(command, "show tacacs%"), "show_tacacs",
        like(command, "show cdp neighbors detail%"), "show_cdp",
        like(command, "show cdp neighbors%"), "show_cdp",
        like(command, "show file systems%"), "show_file",
        like(command, "dir bootflash:%"), "dir_bootflash",
        like(command, "show clock%"), "show_clock",
        like(command, "show platform software status control-processor brief%"), "show_platform",
        like(command, "terminal length 0%"), "terminal",
        like(command, "terminal width 0%"), "terminal",
        true(), null())
    | where isnotnull(command_type)
    | eval user=coalesce(aaa_user, user, "unknown")
    | eval src_ip=coalesce(aaa_src, src_ip, "unknown")
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | bin _time span=5m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  dc(command_type) as unique_recon_commands
                  values(command_type) as command_types
                  values(command) as commands
      by _time dest user src_ip
    | where unique_recon_commands >= 4
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_reconnaissance_command_activity_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    On Nexus, local accounting can emit "%AAA-6-AAA_ACCOUNTING_MESSAGE".
    On Catalyst, use TACACS+ command accounting or EEM catchall syslog for exec command visibility.
known_false_positives: |
    Network audits and troubleshooting can produce similar command bursts. Tune the command list, threshold, and approved administrators for the environment.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ executed $unique_recon_commands$ Cisco reconnaissance command categories on $dest$.
threat_objects:
    - field: commands
      type: command
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1082
    - T1016
    - T1590
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Smart Install Oversized Packet Detection
id: 3b8d2b4f-4e1e-4a9e-9b43-8a7a3a9c7e21
version: 5
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: TTP
description: |
    This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to TCP port 4786
    within the Network_Traffic data model. Abnormally large SMI payloads have been associated with exploitation and
    protocol abuse (e.g., CVE-2018-0171; activity reported by the "Static Tundra" threat actor). Monitoring message
    sizes over time can help identify possible attempts at remote code execution, denial of service, or reconnaissance
    against Cisco devices exposing Smart Install.
data_source:
    - Splunk Stream TCP
search: |
    | tstats `security_content_summariesonly`
        avg(All_Traffic.packets) as avg_packets,
        max(All_Traffic.bytes) as max_bytes
        from datamodel=Network_Traffic
        where All_Traffic.dest_port=4786 AND All_Traffic.transport=tcp
        by All_Traffic.src_ip, All_Traffic.dest_ip, _time span=1h
    | `drop_dm_object_name("All_Traffic")`
    | where max_bytes > 500
    | eval severity=case(max_bytes>1400, "critical", max_bytes>1000, "high", 1=1, "medium")
    | `cisco_smart_install_oversized_packet_detection_filter`
how_to_implement: |
    To implement this search, ingest network traffic into the Network_Traffic data model (e.g., via Splunk Stream with
    sourcetype "stream:tcp"). The search analyzes TCP traffic to destination port 4786 (Cisco Smart Install) over hourly
    buckets, flags sessions with unusually large maximum bytes, and assigns a basic severity based on size thresholds.
    You may tune thresholds or restrict to perimeter-facing traffic. Consider blocking or disabling Smart Install where
    not required.
known_false_positives: |
    Legitimate Smart Install operations (e.g., image/config transfers) can produce larger payloads. Baseline typical sizes
    for your environment and allowlist known management stations when appropriate.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
finding:
    title: Buffer overflow attempt detected in Cisco Smart Install message to $dest_ip$ from $src_ip$
    entity:
        field: dest_ip
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Create Remote Thread In Shell Application
id: 10399c1e-f51e-11eb-b920-acde48001122
version: 13
creation_date: '2021-08-05'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |-
    The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`.
    It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes.
    This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
data_source:
    - Sysmon EventID 8
search: |-
    `sysmon`
    EventCode=8
    TargetImage IN (
        "*\\cmd.exe",
        "*\\powershell_ise.exe",
        "*\\powershell.exe",
        "*\\pwsh.exe"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(NewThreadId) as "NewThreadId"
                  values(StartAddress) as "StartAddress"
      by dest signature_id signature
         SourceProcessGuid SourceProcessId SourceImage
         TargetProcessGuid TargetProcessId TargetImage
         StartModule StartFunction vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `create_remote_thread_in_shell_application_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/
finding:
    title: The process $SourceImage$ created a remote thread into the shell app process $TargetImage$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: SourceImage
      type: process_name
    - field: TargetImage
      type: process_name
analytic_story:
    - IcedID
    - Qakbot
    - Warzone RAT
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Renamed 7-Zip
id: 4057291a-b8cf-11eb-95fe-acde48001122
version: 12
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.original_file_name=7z*.exe
            AND
            Processes.process_name!=7z*.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_renamed_7_zip_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
analytic_story:
    - Collection and Staging
    - Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Auditd Daemon Start
id: 6b0cb0ff-9a7e-4475-a687-43827fdb31d6
version: 6
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation with DAEMON_END, DAEMON_ABORT, and auditctl activity provides visibility into the continuity and integrity of audit logs. Frequent or unexplained DAEMON_START events should be investigated, especially if they are not accompanied by valid administrative or system activity.
data_source:
    - Linux Auditd Daemon Start
search: |-
    `linux_auditd` type=DAEMON_START
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type op res
           auid dest pid
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_auditd_daemon_start_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Auditd service event - [$type$] event occurred on host - [$dest$].
analytic_story:
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1685.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Clipboard Data Copy
id: 9ddfe470-c4d0-4e60-8668-7337bd699edd
version: 9
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*xclip*", "*clipboard*") AND execve_command IN ("*-o*", "*-selection *", "*-sel *" )
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_clipboard_data_copy_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://linux.die.net/man/1/xclip
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to copy data from the clipboard.
analytic_story:
    - Linux Living Off The Land
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1115
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MCP Github Suspicious Operation
id: 3348aefd-9ed8-451f-9993-1e9fa04b5530
version: 3
creation_date: '2026-02-17'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Hunting
description: This detection identifies potentially malicious activity through MCP GitHub server connections, monitoring for secret hunting in code searches, organization and repository reconnaissance, branch protection abuse, CI/CD workflow manipulation, sensitive file access, and vulnerability intelligence gathering. These patterns indicate potential supply chain attacks, credential harvesting, or pre-attack reconnaissance.
data_source:
    - MCP Server
search: |
    `mcp_server` direction=inbound
    | eval dest=host
    | eval
        query_lower=lower('params.query'),
        file_path_lower=lower('params.path'),
        search_query='params.query',
        file_path='params.path',
        target_owner='params.owner',
        is_secret_hunting=if(method="search_code" AND (like(query_lower, "%password%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%") OR like(query_lower, "%token%") OR like(query_lower, "%aws_%") OR like(query_lower, "%private_key%") OR like(query_lower, "%credential%") OR like(query_lower, "%.env%") OR like(query_lower, "%config%")), 1, 0),
        is_org_recon=if(method IN ("list_repositories", "get_repository", "get_organization", "list_organization_members", "get_collaborators", "list_forks", "fork_repository"), 1, 0),
        is_branch_protection_abuse=if(method IN ("update_branch_protection", "delete_branch_protection"), 1, 0),
        is_workflow_manipulation=if((method IN ("create_or_update_file", "push_files")) AND like(file_path_lower, "%github/workflows%"), 1, 0),
        is_sensitive_file_access=if((method IN ("create_or_update_file", "push_files", "get_file_contents")) AND (like(file_path_lower, "%dockerfile%") OR like(file_path_lower, "%package.json%") OR like(file_path_lower, "%requirements.txt%") OR like(file_path_lower, "%.env%") OR like(file_path_lower, "%settings.py%") OR like(file_path_lower, "%config%")), 1, 0),
        is_issue_intel=if(method IN ("list_issues", "search_issues") AND (like(query_lower, "%vulnerability%") OR like(query_lower, "%cve%") OR like(query_lower, "%security%") OR like(query_lower, "%exploit%") OR like(query_lower, "%bug%")), 1, 0)
    | where is_secret_hunting=1 OR is_org_recon=1 OR is_branch_protection_abuse=1 OR is_workflow_manipulation=1 OR is_sensitive_file_access=1 OR is_issue_intel=1
    | eval attack_type=case(
        is_secret_hunting=1, "Secret Hunting",
        is_branch_protection_abuse=1, "Branch Protection Abuse",
        is_workflow_manipulation=1, "Workflow Manipulation",
        is_sensitive_file_access=1, "Sensitive File Access",
        is_issue_intel=1, "Vulnerability Intelligence Gathering",
        is_org_recon=1, "Organization Reconnaissance",
        1=1, "Unknown")
    | stats count min(_time) as firstTime max(_time) as lastTime values(method) as methods values(search_query) as search_queries values(file_path) as file_paths values(target_owner) as target_owners values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table dest firstTime lastTime count attack_diversity attack_types methods search_queries file_paths target_owners
    | `mcp_github_suspicious_operation_filter`
how_to_implement: Install the MCP Technology Add-on from Splunkbase and ensure MCP GitHub server logging is enabled and forwarding to the right index with proper field extraction for params.query, params.path, and params.owner. Schedule the search to run every 5-15 minutes.
known_false_positives: Legitimate developers searching code for refactoring purposes, security teams conducting authorized secret scanning, DevOps engineers modifying workflow files, and repository administrators managing branch protection settings.
references:
    - https://splunkbase.splunk.com/app/8377
    - https://www.docker.com/blog/mcp-horror-stories-github-prompt-injection/
    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
analytic_story:
    - Suspicious MCP Activities
asset_type: Web Application
mitre_attack_id:
    - T1552.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '8323.10383'
title: MSTSC Execution
description: 'MSTSC creates connections to Remote Desktop Session Host servers or
  other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration
  file, and migrates legacy connection files that were created with Client Connection
  Manager to new .rdp connection files. - Threat Actor Association: Vice Society -
  Software Association: Blackcat/ALPHV, Hive, Lockbit - Atomics T1021.001 Test #1
  Atomics T1021.001 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(mstsc) OR "mstsc.exe") | table _time, host,
  user, signature_id, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process, "(?i)mstsc") OR match(process_name, "(?i)mstsc") '
techniques:
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1021.001
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc

name: Ntdsutil Export NTDS
id: da63bc76-61ae-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-28'
modification_date: '2026-05-13'
author: Michael Haag, Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the use of Ntdsutil to export the Active Directory database (NTDS.dit). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because exporting NTDS.dit can be a precursor to offline password cracking, posing a severe security risk. If confirmed malicious, an attacker could gain access to sensitive credentials, potentially leading to unauthorized access and privilege escalation within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ntdsutil_export_ntds_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
    - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
finding:
    title: Active Directory NTDS export on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Credential Dumping
    - HAFNIUM Group
    - Living Off The Land
    - Prestige Ransomware
    - Volt Typhoon
    - Rhysida Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1003.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Randomly Generated Windows Service Name
id: 2032a95a-5165-11ec-a2c3-3e22fbd008af
version: 10
creation_date: '2021-11-30'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Hunting
description: The following analytic detects the installation of a Windows Service with a suspicious, high-entropy name, indicating potential malicious activity. It leverages Event ID 7045 and the `ut_shannon` function from the URL ToolBox Splunk application to identify services with random names. This behavior is significant as adversaries often use randomly named services for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system` EventCode=7045
      | lookup ut_shannon_lookup word as Service_Name
      | where ut_shannon > 3
      | table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name
      | `randomly_generated_windows_service_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. The Windows TA as well as the URL ToolBox application are also required.
known_false_positives: Legitimate applications may use random Windows Service names.
references:
    - https://attack.mitre.org/techniques/T1543/003/
analytic_story:
    - Active Directory Lateral Movement
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '42185.81259'
title: Regini.exe Execution
description: Regini is a Windows command-line tool used to modify registry permissions
  and settings via scriptable .ini files, allowing administrators to automate registry
  management. Threat actors may abuse regini.exe to escalate privileges or establish
  persistence by modifying registry keys—such as SAM, SECURITY, or SYSTEM—to manipulate
  user access rights, enabling RID hijacking or unauthorized credential access. This
  use case detects executions of regini.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<") OR Type=Process) "regini.exe" OR TERM(regini) | where match(process_path,
  "(?i)\x5cregini\.exe") | table _time, host, user, process, process_*, parent_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regini/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini

id: '5851.6129'
title: Rundll32 Command Line
description: 'Adversaries may abuse rundll32.exe to proxy execution of malicious code.
  Using rundll32.exe, may avoid triggering security tools that may not monitor execution
  of the rundll32.exe process because of allowlists or false positives from normal
  operations. Rundll32.exe is commonly associated with executing DLL payloads. This
  use case specifically looks for command line argument executions with rundll32.
  -- Threat Actor Association: Alloy Taurus/Gallium, APT-K-47/Mysterious Elephant,
  APT29/Nobelium/Cozy Bear, APT35/Phosphorus/Magic Hound, FIN7, MuddyWater, Night
  Spider, TA413, TA551, Witchetty, Wizard Spider - Software Association: ALPHV/BlackCat,
  Bazar, Black Basta, Clop, Conti, Hancitor, HermeticWizard, Hive, IcedID, LOWZERO,
  MINEBRIDGE, PowerShortShell, PYSA/Mespinoza, Quantum, Qakbot/Qbot, Ransom Cartel,
  RATDispenser, Rhysida, Sodinokibi/REvil, SquirrelWaffle, Trickbot, XingLocker --
  Atomics T1218.011 Test#1 Atomics T1218.011 Test#2 Atomics T1218.011 Test#3 Atomics
  T1218.011 Test#4 Atomics T1218.011 Test#5 Atomics T1218.011 Test#6 Atomics T1218.011
  Test#7 Atomics T1218.011 Test#8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") TERM(rundll32) | regex process="(?i)(rundll32)" | table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

name: Rundll32 DNSQuery
id: f1483f5e-ee29-11eb-9d23-acde48001122
version: 13
creation_date: '2021-08-03'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious `rundll32.exe` process making HTTP connections and performing DNS queries to web domains. It leverages Sysmon EventCode 22 logs to identify these activities. This behavior is significant as it is commonly associated with IcedID malware, where `rundll32.exe` checks internet connectivity and communicates with C&C servers to download configurations and other components. If confirmed malicious, this activity could allow attackers to establish persistence, download additional payloads, and exfiltrate sensitive data, posing a severe threat to the network.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon` EventCode=22 process_name="rundll32.exe"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY answer answer_count dvc
           process_exec process_guid process_name
           query query_count reply_code_id
           signature signature_id src
           user_id vendor_product QueryName
           QueryResults QueryStatus
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `rundll32_dnsquery_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: No false positives have been identified at this time.
references:
    - https://any.run/malware-trends/icedid
finding:
    title: rundll32 process $process_name$ made a DNS query for $query$ from host $dvc$
    entity:
        field: dvc
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - IcedID
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

id: '14971.22212'
title: Security Software Discovery via WMI
description: 'Adversaries may attempt to get a listing of security software, configurations,
  defensive tools, and sensors that are installed on a system or in a cloud environment.
  This may include things such as firewall rules and anti-virus. Adversaries may use
  the information from Security Software Discovery during automated discovery to shape
  follow-on behaviors, including whether or not the adversary fully infects the target
  and/or attempts specific actions. This use case detects enumeration commands for
  antivirus software using WMI. Atomics Test T1518.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(wmic) TERM(AntiVirusProduct)
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user| regex process="(?i)\s+AntiVirusProduct\s+" | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518.001/T1518.001.md#atomic-test-6---security-software-discovery---av-discovery-via-wmi

name: Windows AD DSRM Password Reset
id: d1ab841c-36a6-46cf-b50f-b2b04b31182a
version: 10
creation_date: '2022-09-08'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic detects attempts to reset the Directory Services Restore Mode (DSRM) administrator password on a Domain Controller. It leverages event code 4794 from the Windows Security Event Log, specifically looking for events where the DSRM password reset is attempted. This activity is significant because the DSRM account can be used similarly to a local administrator account, providing potential persistence for an attacker. If confirmed malicious, this could allow an attacker to maintain administrative access to the Domain Controller, posing a severe risk to the domain's security.
data_source:
    - Windows Event Log Security 4794
search: |-
    | tstats `security_content_summariesonly` min(_time) as _time FROM datamodel=Change
      WHERE All_Changes.result_id="4794"
        AND
        All_Changes.result="set the Directory Services Restore Mode administrator password"
      BY All_Changes.action, All_Changes.dest, All_Changes.src,
         All_Changes.user
    | `drop_dm_object_name(All_Changes)`
    | `windows_ad_dsrm_password_reset_filter`
how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4794` and  have the Advanced Security Audit policy `Audit User Account Management` within `Account Management` enabled.
known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately.
references:
    - https://adsecurity.org/?p=1714
finding:
    title: DSRM Account Password was reset on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: DSRM Account Password was reset on $dest$ by $user$
analytic_story:
    - Sneaky Active Directory Persistence Tricks
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DISM Remove Defender
id: 8567da9e-47f0-11ec-99a9-acde48001122
version: 15
creation_date: '2021-12-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of `dism.exe` to remove Windows Defender. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific parameters for disabling and removing Windows Defender. This activity is significant because adversaries may disable Defender to evade detection and carry out further malicious actions undetected. If confirmed malicious, this could lead to the attacker gaining persistent access, executing additional payloads, or exfiltrating sensitive data without being intercepted by Windows Defender.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=dism.exe (Processes.process="*/online*"
        AND
        Processes.process="*/disable-feature*"
        AND
        Processes.process="*Windows-Defender*"
        AND
        Processes.process="*/remove*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dism_remove_defender_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
references:
    - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - CISA AA23-347A
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint